EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 10 )

Updated On: 12-May-2026

Which IOS jailbreaking technique patches the kernel during the device boot so that it becomes jailbroken after each successive reboot?

  1. Tethered jailbreaking
  2. Semi-untethered jailbreaking
  3. Semi-tethered jailbreaking
  4. Untethered jailbreaking

Answer(s): D

Explanation:

A short explanation: Untethered jailbreaking patches the kernel in a persistent way so the device boots jailbroken without any connection or user action after each reboot.
A) Tethered jailbreaking is not persistent across reboots; it requires a computer to boot into the jailbroken state.
B) Semi-untethered is recoverable on reboot via user action or app, not fully persistent.
C) Semi-tethered (duplicate option) also requires action after reboot to maintain jailbreak state.
D) Untethered correctly indicates a permanent kernel patch that survives reboots.



Stella, a professional hacker, performs an attack on web services by exploiting a vulnerability that provides additional routing information in the SOAP header to support asynchronous communication. This further allows the transmission of web-service requests and response messages using different TCP connections.

Which of the following attack techniques is used by Stella to compromise the web services?

  1. Web services parsing attacks
  2. WS-Address spoofing
  3. SOAPAction spoofing
  4. XML injection

Answer(s): B

Explanation:

Stacks WS-Address spoofing. It exploits SOAP header routing info to influence message delivery across separate TCP connections, enabling asynchronous web service communication spoofing the WS-Addressing headers to redirect or correlate requests/responses.
A) Web services parsing attacks are about malformed XML/SOAP content causing parsing errors, not manipulating routing headers or asynchronous connections.
C) SOAPAction spoofing targets the SOAPAction HTTP header to influence operation selection, not routing or multi-connection transit.
D) XML injection injects arbitrary XML data, not specifically altering WS-Addressing routing or connection semantics.



Attacker Steve targeted an organization's network with the aim of redirecting the company's web traffic to another malicious website. To achieve this goal, Steve performed DNS cache poisoning by exploiting the vulnerabilities in the DNS server software and modified the original IP address of the target website to that of a fake website.

What is the technique employed by Steve to gather information for identity theft?

  1. Pharming
  2. Skimming
  3. Pretexting
  4. Wardriving

Answer(s): A

Explanation:

Steve used pharming, which poisons DNS to redirect users to a malicious site and harvest credentials or information.
A) Pharming is correct because it relies on DNS manipulation to alter the target domain resolution and deceive users.
B) Skimming involves physically or electronically stealing payment details at the point of sale, not DNS manipulation.
C) Pretexting is social engineering by creating a fabricated scenario to obtain information, not technical DNS poisoning.
D) Wardriving is locating wireless networks by vehicle movement, unrelated to DNS cache poisoning or credential harvesting.



What is the port to block first in case you are suspicious that an IoT device has been compromised?

  1. 22
  2. 48101
  3. 80
  4. 443

Answer(s): B

Explanation:

A compromised IoT device should be isolated by blocking its outbound C2 and control channels, which commonly use non-standard or well-known ports chosen by attackers; blocking 48101 helps disrupt potential covert command-and-control traffic often used by IoT malware.
A) 22 is SSH; blocking it may hinder legitimate admin access but not necessarily stop C2 traffic.
C) 80 is HTTP; blocking it disrupts web traffic but many devices use other ports.
D) 443 is HTTPS; blocking it stops encrypted web traffic but may impede legitimate secure communications.



Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection.

Identify the behavior of the adversary in the above scenario.

  1. Unspecified proxy activities
  2. Use of command-line interface
  3. Data staging
  4. Use of DNS tunneling

Answer(s): A

Explanation:

The correct answer is A) Unspecified proxy activities because creating and configuring multiple domains pointing to the same host to switch domains is characteristic of using proxy-like behavior to obfuscate command and control or resource access, without specifying a standard proxy protocol. B) Use of command-line interface is not indicated by domain manipulation alone. C) Data staging involves collecting and prepping data for exfiltration, not domain hopping. D) Use of DNS tunneling requires DNS queries to carry data, which is not described here. The behavior is proxy-like domain switching, not explicit DNS tunneling or CLI usage.



What firewall evasion scanning technique make use of a zombie system that has low network activity as well as its fragment identification numbers?

  1. Packet fragmentation scanning
  2. Spoof source address scanning
  3. Decoy scanning
  4. Idle scanning

Answer(s): D

Explanation:

Idle scanning uses a zombie host with minimal network activity and examines IP ID field (fragment identifiers) to infer open ports on a target without sending direct probes. A) Packet fragmentation scanning relies on sending fragmented packets to reveal open ports via reassembly behavior, not zombie idle state. B) Spoof source address scanning masks origin but not zombie IP ID behavior. C) Decoy scanning uses multiple decoy IPs to confuse IDS, not leveraging a zombie’s ID field. D) Idle scanning correctly matches a vulnerable zombie’s predictable IP ID increments to map ports.



By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login and password in plaintext.

Which file do you have to clean to clear the password?

  1. .xsession-log
  2. .profile
  3. .bashrc
  4. .bash_history

Answer(s): D

Explanation:

A) D) .bash_history
The password may be stored in the shell history during interactive sessions; clearing the Bash history removes commands and inputs, including plaintext credentials, from the command recall buffer.
A) .xsession-log is a graphical session log and does not systematically retain plaintext passwords from SMB logins.
B) .profile is executed on login to set environment variables and startup programs, not a transcript of commands.
C) .bashrc contains user-specific shell initialization, not a persistent record of executed commands from all sessions.



Jack, a disgruntled ex-employee of Incalsol Ltd., decided to inject fileless malware into Incalsol's systems. To deliver the malware, he used the current employees' email IDs to send fraudulent emails embedded with malicious links that seem to be legitimate. When a victim employee clicks on the link, they are directed to a fraudulent website that automatically loads Flash and triggers the exploit.

What is the technique used by Jack to launch the fileless malware on the target systems?

  1. In-memory exploits
  2. Legitimate applications
  3. Script-based injection
  4. Phishing

Answer(s): D

Explanation:

Phishing is correct because Jack uses social engineering via fraudulent emails to lure victims into a site that loads the exploit, delivering malware without needing a downloadable payload on disk (fileless behavior) once the user accesses the link.
A) In-memory exploits are not the initial delivery method; they describe techniques that execute in RAM but don’t specify the social-engineering delivery vector used here.
B) Legitimate applications imply abuse of trusted software, which is not the described phishing email and fake site scenario.
C) Script-based injection refers to injecting scripts into vulnerable targets, not the email-driven phishing chain initiating the attack.



Viewing page 10 of 105
Viewing questions 73 - 80 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!